Is there a public PoC exploit available for CVE-2025-7817?

Yes, a public proof-of-concept exploit is available for CVE-2025-7817. Prioritise patching immediately. EPSS: 0.1%.

PHPGurukul Apartment Visitors Management System CVE-2025-7817

Q: What is the CVSS score of CVE-2025-7817?

CVE-2025-7817 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

LOW

Cross-site Scripting (XSS) (CWE-79)

2025-07-19 cna@vuldb.com

PHP XSS Apartment Visitors Management System Phpgurukul

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 01:21 vuln.today

DescriptionCVE.org

A vulnerability has been found in PHPGurukul Apartment Visitors Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /bwdates-reports.php of the component HTTP POST Request Handler. The manipulation of the argument visname leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

AnalysisAI

Reflected cross-site scripting (XSS) in PHPGurukul Apartment Visitors Management System 1.0 allows authenticated remote attackers to inject malicious scripts via the visname parameter in /bwdates-reports.php, executing arbitrary JavaScript in victim browsers when user interaction occurs. Publicly available exploit code exists; EPSS score of 0.05% indicates low real-world exploitation probability despite public POC availability.

Technical ContextAI

This is a reflected cross-site scripting vulnerability (CWE-79) in a PHP-based apartment management application. The vulnerable endpoint /bwdates-reports.php fails to properly sanitize or validate the visname HTTP POST parameter before rendering it in the HTTP response. The HTTP POST Request Handler component does not encode user-controlled input destined for HTML context, allowing attackers to inject script tags or event handlers. The vulnerability exists in PHPGurukul's apartment management suite, which is a PHP application commonly used in property management scenarios.

RemediationAI

No vendor-released patch has been identified at time of analysis. Organizations using this product should immediately upgrade to a patched version if available from the vendor, or contact PHPGurukul at phpgurukul.com for security updates. As compensating controls, implement HTML entity encoding on all user inputs before output in /bwdates-reports.php (specifically the visname parameter), apply input validation to reject special characters in the visname field, and deploy a Web Application Firewall (WAF) with XSS detection rules to filter malicious script injection attempts. Additionally, enforce Content-Security-Policy (CSP) headers to restrict inline script execution, which mitigates stored and reflected XSS impact even if input validation is bypassed-note this may require application modifications and testing to avoid breaking legitimate functionality.